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REMARKS 

The Examiner has objected to the drawings. Such objection is deemed overcome 
by virtue of the drawing corrections submitted herewith. 

The Examiner has rejected Claims 1-7, 10, 15-18, 20, 24-31, 34, 39-42, 44, and 
50 under 35 U.S.C. 102(e) as being anticipated by Muttik, U.S. Patent No. 6,775,780. 
This rejection is deemed moot in view of the amendments made hereinabove. 
Specifically, the subject matter of Claims 8 ; 1 1-12 et al. has been substantially 
incorporated into each of the independent claims. 

The Examiner has rejected the subject matter of Claims 8, 1 1-12 et al. under 35 
U.S.C. 103(a) as being unpatentable over Muttik, U.S. Patent No. 6,775,780, in view of 
Jordan, U.S. Patent Application Publication No. 2002/0073323. Applicant again 
respectfully disagrees with this rejection. 

Specifically, the Examiner relies on Jordan to meet applicant's claimed "wherein 
the opened share mode indicates a file structure parameter and a name parameter" (see 
subject matter of former Claim 8 et al., now incorporated into each of the independent 
claims). The Examiner cites the following excerpt from Jordan, and asserts that "Jordan 
discloses a virus detection system similar to that of Muttik's in which the computer 
determines in virtual space whether the applications exhibit malicious behavior based on 
whether they attempt to access privileged resources on a computer." 

"[COOS] The disclosure provides a method of detecting a computer 
virus that attempts to gain access to restricted computer system 
resources. The method includes, in accordance with one 
embodiment, emulating computer executable code in a subject file, 
and monitoring the emulation of the computer, executable code and 
monitoring modification of memory state by the emulated code 
execution,' to detect an attempt by the emulated code to access 
one or more of the restricted computer system resources." 
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Whether or not the Examiner's statement is true, the foregoing excerpt from 
Jordan (as well as the remaining Jordan reference, for that matter) fails to even suggest a 
mode that specifically indicates a file structure paramete r and a name parameter, as 
claimed. Jordan merely mentions 'Tiles" in the context of emulating such files, not 
running a computer in an opened share mode, wherein the opened share m ode indicates a 
file structure parameter and a name parameter , as claimed. 

Further, the Examiner again relies on Jordan to meet applicant's claimed "wherein 
the opened share mode applies only to a predetermined list of application programs 
executable on the computer" (see at least a portion of such subject matter of former 
Claim 1 1 et al. ? now incorporated into each of the independent claims). The Examiner 
cites the foregoing excerpt from Jordan, and asserts that "Jordan teaches a virus detection 
system similar to Muttik's in which virus detection and protection is implemented to 
allow a user to access resources that aren't protected and block access to resources that 
are protected." 

Again, whether or not the Examiner's statement is true, the foregoing excerpt 
from Jordan (as well as the remaining Jordan reference, for that matter) fails to even 
suggest an "opened share mode" that specifically applies only to a predetermined list of 
application programs and/or data, as claimed. Jordan merely suggests "restricted 
resources," and thus teaches away from any sort of "opened share mode," let alone such a 
mode that allows access to a predetermined list of application programs and/or data. 

With respect to the subject matter of former Claim 12 et al,, now incorporated into 
each of the independent claims, the Examiner merely points to the rules 210 of Figure 2 
from Muttik, as a sole citation supporting a rejection of such claimed subject matter. In 
response, applicant has carefully reviewed such excerpt as well as the remaining Jordan 
and Muttik references, and there is simply not even a suggestion of any sort of "opened 
share mode" that specifically applies only to a predetermined list of application programs 
and/or data that is manually selected, as claimed. 
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To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art reference fails to teach or 
suggest all the claim limitations . Despite the aforementioned paramount differences, 
applicant now teaches and claims "monitoring attempts to access the computer by 
applications utilizing the network , using the file structure and name parameter " (emphasis 
added). 

To this end, all of the pending independent claims are deemed allowable, along 
with any dependent claims depending therefrom. A notice of allowance or a specific 
prior art showing of each of the foregoing limitations, in combination with the remaining 
claim elements, is respectfully requested. 

It is further noted that the Examiner's rejection of applicant's dependent claims is 
replete with deficiencies. Just by way of example, the Examiner relies on the following 
excerpt from Muttik to make a prior art showing of applicant's claimed, "wherein the 
computer operates in the virtual opened share mode by modifying an application program 
interface" (see Claim 5 etal.). 

"During the emulation process, the system records system calls 
(API calls) generated by code 108 (step 306} . The system also 
emulates the execution of the system calls to the extent 
necessary to accurately predict the execution path through code 
108 (step 308} . Next, comparison unit 204 applies comparison 
rules 210 in order zo compare the record of system calls against 
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profiles of system calls generated by known malicious code (step 
310) . Recall, that this comparison process can take place on-the- 
fly as the system calls are generated, or alternatively, off- 
line, after a number of system calls a generated." (col. 4, lin^s 
32-41) 

Applicant respectfully disagrees with this assertion. Muttik merely monitors the 
execution of API calls for emulation purposes. This, in no way, meets applicant's 
claimed virtual opened share mode that is provided by modifying an application program 
interface . 

Still yet, the Examiner simply dismisses the following claimed feature as being 
obvious "wherein the opened share mode indicates a plurality of parameters that are 
randomly selected to prevent detection" (see Claim 9 et al.). Applicant respectfully 
disagrees. By randomly selecting such parameters, writers of malicious code can not 
easily identify certain parameters as being associated with the security measures set forth 
herein. For these reasons, applicant asserts that such feature would not be obvious. 

Even still, it appears that various other claims (e.g. Claims 6, 7 S 48, et al., for 
example) have been dismissed as being well known without a specific prior art showing. 
In response, applicant again points out the remarks above that clearly show the mariner in 
which some of such claims further distinguish the prior art. Applicant thus formally 
requests a specific showing of the subject matter in ALL of the claims in any future 
action. Note excerpt from MPEP below. 

v If the applicant traverses such an [Official Notice] assertion 
the examiner should cite a reference in support of his or her 
position." See MPEP 2144.03. 

Again, applicant respectfully asserts that at least the third element of the prima 
facie case of obviousness has not been met, since the prior art reference fails to teach or 
suHgest all the claim limitations . A notice of allowance or a specific prior art showing of 
each of the foregoing limitations, in combination with the remaining claim elements, is 
respectfully requested. 
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Still yet, applicant brings the Examiner's attention to the following subject matter 
in the added dependent claims, for full consideration: 

"wherein the file structure includes a tree structure" (see Claim 53); 

"wherein the computer is run in an actual opened share mode and a virtual opened 
share mode such that the at least one of application programs and data is 
accessible in the actual opened share mode, and attempted access to the at least 
one of application programs and data associated with the virtual opened shared 
mode prompts a security process" (see Claim 54); and 

"wherein the security processjncludes temporarily logging off the network, 
recording in a record information on any attempt to modify the computer 
including time and source information, logging the computer back on the network 
in a mode other than the actual opened share mode, transmitting the information 
to a third party, determining whether a trend is found indicative of a coordinated 
attack, and sending an alert and logging a culpable computer off the network 
based on the determination" (see Claim 55). 

Again, a notice of allowance or a specific prior art showing of each of the 
foregoing limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Reconsideration is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5 1 00. Applicants are 
enclosing a check to pay for the added claims. The Commissioner is authorized to charge 
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any additional fees or credit any overpayment to Deposit Account No. 50-1351 (Order 
No. NAI1P019). 

Respectfully submitted. 




P.O. Box 721120 
San Jose, CA 95172-112* 
408-505-5100 




Zilka 
ationNo. 41,429 
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